<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>vx逆向分析随笔 | Forgo7ten'blog</title><meta name="keywords" content="Android逆向"><meta name="author" content="Forgo7ten"><meta name="copyright" content="Forgo7ten"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="vx逆向分析随笔 ¶  另外有Android逆向可以一起交流学习呀。点击联系我，一个人闷搞挺没劲的。 @app_version &#x3D; 7.0.20 @app_date &#x3D; 2020.11.19 本来是想分析vx8的，但是电脑性能不够……反编译工具直接卡死 vx Log日志 ¶  当进行分析时，发现反复调用了ae.i,ae.d方法  来到com.tencent.mm.sdk.platformtools">
<meta property="og:type" content="article">
<meta property="og:title" content="vx逆向分析随笔">
<meta property="og:url" content="https://forgo7ten.github.io/AndroidReverse/2021/Analysis_of_WeChat/index.html">
<meta property="og:site_name" content="Forgo7ten&#39;blog">
<meta property="og:description" content="vx逆向分析随笔 ¶  另外有Android逆向可以一起交流学习呀。点击联系我，一个人闷搞挺没劲的。 @app_version &#x3D; 7.0.20 @app_date &#x3D; 2020.11.19 本来是想分析vx8的，但是电脑性能不够……反编译工具直接卡死 vx Log日志 ¶  当进行分析时，发现反复调用了ae.i,ae.d方法  来到com.tencent.mm.sdk.platformtools">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://forgo7ten.gitee.io/store/imgs/18.jpg">
<meta property="article:published_time" content="2021-08-13T16:00:00.000Z">
<meta property="article:modified_time" content="2021-08-19T16:00:00.000Z">
<meta property="article:author" content="Forgo7ten">
<meta property="article:tag" content="Android逆向">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://forgo7ten.gitee.io/store/imgs/18.jpg"><link rel="shortcut icon" href="/images/favicon.jpg"><link rel="canonical" href="https://forgo7ten.github.io/AndroidReverse/2021/Analysis_of_WeChat/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//hm.baidu.com"/><link rel="preconnect" href="//www.clarity.ms"/><link rel="preconnect" href="//fonts.googleapis.com" crossorigin=""/><link rel="preconnect" href="//busuanzi.ibruce.info"/><meta name="google-site-verification" content="8L0ZjthONyq6-m7FniRTH8A7Bh0x-KOPZbKOcNimnYA"/><meta name="baidu-site-verification" content="code-gjVsyPt7yr"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.css" media="print" onload="this.media='all'"><script>var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?b076845d73a4f28b3c7401b2a0a8a9db";
  var s = document.getElementsByTagName("script")[0]; 
  s.parentNode.insertBefore(hm, s);
})();
</script><script>(function(c,l,a,r,i,t,y){
    c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};
    t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;
    y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);
})(window, document, "clarity", "script", "9zbibmmffi");</script><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Titillium+Web&amp;display=swap" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: {"path":"search.xml","languages":{"hits_empty":"找不到您查询的内容：${query}"}},
  translate: {"defaultEncoding":2,"translateDelay":0,"msgToTraditionalChinese":"繁","msgToSimplifiedChinese":"簡"},
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":300},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: true,
    post: false
  },
  runtime: '天',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: {"chs_to_cht":"你已切换为繁体","cht_to_chs":"你已切换为简体","day_to_night":"你已切换为深色模式","night_to_day":"你已切换为浅色模式","bgLight":"#49b1f5","bgDark":"#121212","position":"bottom-left"},
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: true,
  isAnchor: true
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: 'vx逆向分析随笔',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2021-08-20 00:00:00'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="Forgo7ten'blog" type="application/atom+xml">
</head><body><div id="loading-box"><div class="loading-left-bg"></div><div class="loading-right-bg"></div><div class="spinner-box"><div class="configure-border-1"><div class="configure-core"></div></div><div class="configure-border-2"><div class="configure-core"></div></div><div class="loading-word">加载中...</div></div></div><div id="web_bg"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/images/avatar.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data is-center"><div class="data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">20</div></a></div><div class="data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">8</div></a></div><div class="data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">6</div></a></div></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/18.jpg')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">Forgo7ten'blog</a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">vx逆向分析随笔</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2021-08-13T16:00:00.000Z" title="发表于 2021-08-14 00:00:00">2021-08-14</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2021-08-19T16:00:00.000Z" title="更新于 2021-08-20 00:00:00">2021-08-20</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Android%E9%80%86%E5%90%91/">Android逆向</a><i class="fas fa-angle-right post-meta-separator"></i><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Android%E9%80%86%E5%90%91/%E5%B0%8F%E5%B1%95%E8%BA%AB%E6%89%8B/">小展身手</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-wordcount"><i class="far fa-file-word fa-fw post-meta-icon"></i><span class="post-meta-label">字数总计:</span><span class="word-count">7.9k</span><span class="post-meta-separator">|</span><i class="far fa-clock fa-fw post-meta-icon"></i><span class="post-meta-label">阅读时长:</span><span>39分钟</span></span><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="vx逆向分析随笔"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><h1 id="vx逆向分析随笔">vx逆向分析随笔<a class="header-anchor" href="#vx逆向分析随笔"> ¶ </a></h1>
<p>另外有Android逆向可以一起交流学习呀。<a class="btn-beautify " href="/./about" title="点击联系我"><i class="far fa-hand-point-right"></i><span>点击联系我</span></a>，一个人闷搞挺没劲的。</p>
<p>@app_version = 7.0.20</p>
<p>@app_date = 2020.11.19</p>
<p>本来是想分析vx8的，但是电脑性能不够……反编译工具直接卡死</p>
<h2 id="vx-Log日志">vx Log日志<a class="header-anchor" href="#vx-Log日志"> ¶ </a></h2>
<p>当进行分析时，发现反复调用了<code>ae.i</code>,<code>ae.d</code>方法</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210814171654155.png" alt="image-20210814171654155"></p>
<p>来到<code>com.tencent.mm.sdk.platformtools.ae;</code>查看</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210814171854620.png" alt="image-20210814171854620"></p>
<p>同时找到了<code>setConsoleLogOpen</code>方法，猜测这是对控制台log全局控制的方法</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210814172452010.png" alt="image-20210814172452010"></p>
<p>对该方法向上追溯，得到</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">com.tencent.mm.sdk.platformtools.ae<span class="variable">$a</span>;setConsoleLogOpen</span><br><span class="line">com.tencent.mm.sdk.platformtools.ae;setConsoleLogOpen</span><br><span class="line">com.tencent.mm.xlog.app.XLogSetup;keep_setupXLog</span><br><span class="line">com.tencent.mm.xlog.app.XLogSetup;realSetupXlog</span><br><span class="line">com.tencent.mm.plugin.account.ui.SimpleLoginUI;onCreate/com.tencent.mm.ui.LauncherUI;onResume</span><br></pre></td></tr></table></figure>
<p>其中设置log的是keep_setupXLog的p5参数</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">public</span> <span class="keyword">static</span> <span class="keyword">void</span> <span class="title">keep_setupXLog</span><span class="params">(<span class="keyword">boolean</span> p0,String p1,String p2,Integer p3,Boolean p4,Boolean p5,String p6)</span></span>&#123;</span><br><span class="line">   <span class="comment">// ...</span></span><br><span class="line">   XLogSetup.cachePath = p1;	<span class="comment">// 缓存目录:/data/user/0/com.tencent.mm/files/xlog</span></span><br><span class="line">   XLogSetup.logPath = p2;		<span class="comment">// log目录:/storage/emulated/0/Android/data/com.tencent.mm/MicroMsg/xlog</span></span><br><span class="line">   XLogSetup.toolsLevel = p3;	<span class="comment">// 工具版本:null</span></span><br><span class="line">   XLogSetup.appendIsSync = p4;</span><br><span class="line">   XLogSetup.isLogcatOpen = p5;	<span class="comment">// 是否开启日志:false</span></span><br><span class="line">   XLogSetup.nameprefix = p6;	<span class="comment">// 前缀:MM</span></span><br><span class="line">   <span class="keyword">if</span> (!p0) &#123;	</span><br><span class="line">      <span class="comment">// ...</span></span><br><span class="line">   &#125;<span class="keyword">else</span> <span class="keyword">if</span>(XLogSetup.setup)&#123;		</span><br><span class="line">      <span class="comment">// ...</span></span><br><span class="line">   &#125;<span class="keyword">else</span> &#123;	</span><br><span class="line">      <span class="comment">// ...</span></span><br><span class="line">      ae.setConsoleLogOpen(XLogSetup.isLogcatOpen.booleanValue());</span><br><span class="line">      <span class="comment">// ...</span></span><br><span class="line">   &#125;</span><br><span class="line">   <span class="keyword">return</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>于是开启log只需要给<code>p5</code>赋值为<code>true</code></p>
<p>frida脚本</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="comment">/*</span></span><br><span class="line"><span class="comment">    * 开启vx全局日志</span></span><br><span class="line"><span class="comment">    */</span></span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.xlog.app.XLogSetup&#x27;</span>);</span><br><span class="line">    clazz.keep_setupXLog.overload(<span class="string">&#x27;boolean&#x27;</span>, <span class="string">&#x27;java.lang.String&#x27;</span>, <span class="string">&#x27;java.lang.String&#x27;</span>, <span class="string">&#x27;java.lang.Integer&#x27;</span>, <span class="string">&#x27;java.lang.Boolean&#x27;</span>, <span class="string">&#x27;java.lang.Boolean&#x27;</span>, <span class="string">&#x27;java.lang.String&#x27;</span>).implementation = <span class="function"><span class="keyword">function</span>(<span class="params">p0,p1,p2,p3,p4,p5,p6</span>) </span>&#123;</span><br><span class="line"></span><br><span class="line">        <span class="comment">//console.log(&quot;arguments&quot;,arguments[5]);</span></span><br><span class="line">        <span class="built_in">arguments</span>[<span class="number">5</span>] = Java.use(<span class="string">&quot;java.lang.Boolean&quot;</span>).TRUE.value;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;已开启vx Log打印&quot;</span>);</span><br><span class="line">        <span class="keyword">return</span> clazz.keep_setupXLog.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<h2 id="vx发送消息">vx发送消息<a class="header-anchor" href="#vx发送消息"> ¶ </a></h2>
<p>使用<code>DDMS</code>的<code>Start Method Profiling</code>功能，同时点击【发送】键</p>
<p>然后停止记录，搜索<code>onClick</code>关键字，定位到类<code>com.tencent.mm.pluginsdk.ui.chat.ChatFooter$7</code></p>
<p>其中<code>sstr</code>为输入的字符串内容</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815161220040.png" alt="image-20210815161220040"></p>
<p>尝试hook <code>ChatFooter.a</code>方法</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.pluginsdk.ui.chat.ChatFooter&#x27;</span>);</span><br><span class="line">    clazz.a.overload(<span class="string">&#x27;com.tencent.mm.pluginsdk.ui.chat.ChatFooter&#x27;</span>, <span class="string">&#x27;java.lang.String&#x27;</span>).implementation = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;Send Message&quot;</span>,<span class="built_in">arguments</span>[<span class="number">1</span>]);</span><br><span class="line">        <span class="keyword">return</span> clazz.a.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p>可以得到输出</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">Send Message 1</span><br><span class="line">Send Message 2</span><br><span class="line">Send Message [微笑]</span><br><span class="line">Send Message 😂</span><br></pre></td></tr></table></figure>
<h2 id="vx聊天窗口-修改内容">vx聊天窗口/修改内容<a class="header-anchor" href="#vx聊天窗口-修改内容"> ¶ </a></h2>
<h3 id="定位">定位<a class="header-anchor" href="#定位"> ¶ </a></h3>
<p>使用<code>DDMS</code>的<code>Dump View Hierarchy for UI Automator</code>来定位控件ID</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815003423908.png" alt="image-20210815003423908"></p>
<p>查看顶层activity</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">adb shell dumpsys activity top</span><br></pre></td></tr></table></figure>
<p>再找控件ID，最终定位到<code>com.tencent.mm.ui.chatting.view.MMChattingListView</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815003515022.png" alt="image-20210815003515022"></p>
<h3 id="分析">分析<a class="header-anchor" href="#分析"> ¶ </a></h3>
<h4 id="MMChattingListView">MMChattingListView<a class="header-anchor" href="#MMChattingListView"> ¶ </a></h4>
<p>这是一个<code>ListView</code></p>
<p>发现了List的<code>Adapter</code>，</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815004245534.png" alt="image-20210815004245534"></p>
<p>交叉引用查看是哪里调用了这个方法</p>
<p>跟到<code>com.tencent.mm.ui.chatting.ChattingUIFragment</code>的<code>fTJ</code>方法</p>
<h4 id="ChattingUIFragment">ChattingUIFragment<a class="header-anchor" href="#ChattingUIFragment"> ¶ </a></h4>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815004604975.png" alt="image-20210815004604975"></p>
<p>发现这个<code>Fragment</code>对Adapter进行了设置，同时存放在了<code>this.Lrn</code>字段</p>
<p>其中<code>this.Lrr</code>类型为<code>MMChattingListView</code>，<code>this.Lro</code>的类型为<code>ListView</code></p>
<p>也可以得到Adapter的类型为<code>com.tencent.mm.ui.chatting.a.a</code>，同时继承了<code>BaseAdapter</code></p>
<h4 id="Adapter">Adapter<a class="header-anchor" href="#Adapter"> ¶ </a></h4>
<p>根据其重写的<code>getCount</code>方法，得到数据源是<code>this.LtF</code>字段</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815010612094.png" alt="image-20210815010612094"></p>
<p>而<code>this.LtF</code>字段的定义是</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">public SparseArray LtF;</span><br></pre></td></tr></table></figure>
<p>使用frida hook一下，查看一下SparseArray每个元素的类型</p>
<p>随便hook了一个Fragment的<code>zt</code>方法（因为看Log日志每次操作都会执行）</p>
<p>获得Fragment的<code>Lrn</code>字段也就是Adapter</p>
<p>再直接调用<code>getCount()</code>和<code>getItem()</code>获取到数据源的单个数据</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(function() &#123;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.ui.chatting.ChattingUIFragment&#x27;</span>);</span><br><span class="line">    clazz.zt.implementation = function() &#123;</span><br><span class="line">        console.log(<span class="string">&quot;this.Lrn.value&quot;</span>,<span class="keyword">this</span>.Lrn.value);</span><br><span class="line">        <span class="keyword">var</span> adapter = Java.cast(<span class="keyword">this</span>.Lrn.value,Java.use(<span class="string">&quot;com.tencent.mm.ui.chatting.a.a&quot;</span>))</span><br><span class="line">        console.log(<span class="string">&quot;adapter&quot;</span>,adapter);</span><br><span class="line">        console.log(<span class="string">&quot;adapter.getCount&quot;</span>,adapter.getCount());</span><br><span class="line">        console.log(<span class="string">&quot;LtF&quot;</span>,adapter.LtF.value);</span><br><span class="line">        <span class="keyword">var</span> adapter_size = adapter.getCount();</span><br><span class="line">        <span class="keyword">var</span> msg = adapter.getItem(<span class="number">0</span>);</span><br><span class="line">        console.log(<span class="string">&quot;msg&quot;</span>,msg);</span><br><span class="line">        <span class="keyword">return</span> clazz.zt.apply(<span class="keyword">this</span>, arguments);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p>此时手机界面为</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/img.png" alt="img"></p>
<p>获得输出为</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">this.Lrn.value com.tencent.mm.ui.chatting.a.a@f945978</span><br><span class="line">adapter com.tencent.mm.ui.chatting.a.a@f945978</span><br><span class="line">adapter.getCount 5</span><br><span class="line">LtF &#123;0=com.tencent.mm.storage.bz@cc74ce8, 1=com.tencent.mm.storage.bz@dba9f01, 2=com.tencent.mm.storage.bz@ae31a6, 3=com.tencent.mm.storage.bz@9afe7e7, 4=com.tencent.mm.storage.bz@c384f94&#125;</span><br><span class="line">msg com.tencent.mm.storage.bz@cc74ce8</span><br></pre></td></tr></table></figure>
<p>可以知道每个数据的类型是<code>com.tencent.mm.storage.bz</code></p>
<h4 id="每条消息-storage-bz">每条消息 <a target="_blank" rel="noopener" href="http://storage.bz">storage.bz</a><a class="header-anchor" href="#每条消息-storage-bz"> ¶ </a></h4>
<p>该类的继承关系为</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">com.tencent.mm.storage.bz</span><br><span class="line">com.tencent.mm.ah.aa</span><br><span class="line">com.tencent.mm.g.c.ej</span><br><span class="line">com.tencent.mm.sdk.e.c</span><br></pre></td></tr></table></figure>
<p>查看个方法，发现里面有如下字段</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815143427853.png" alt="image-20210815143427853"></p>
<p>这些字段是<code>ej</code>类的</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815144136894.png" alt="image-20210815144136894"></p>
<p>同时<code>bz</code>还有5个子类</p>
<p><code>bz$a</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815152148504.png" alt="image-20210815152148504"></p>
<p><code>bz$b</code>，大概是有关位置的</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815152234412.png" alt="image-20210815152234412"></p>
<p><code>bz$c</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815152302867.png" alt="image-20210815152302867"></p>
<p><code>bz$d</code>，可以看到<code>nickname</code>, <code>cityCode</code>, <code>CountryCode</code>字段</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210815152614851.png" alt="image-20210815152614851"></p>
<h3 id="脚本实现">脚本实现<a class="header-anchor" href="#脚本实现"> ¶ </a></h3>
<p>最终选择hook的是Adapter的<code>notifyDataSetChanged</code>方法，这样可以对最后的消息进行查看以及修改</p>
<p>修改一下消息内容</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.ui.chatting.a.a&#x27;</span>);</span><br><span class="line">    clazz.notifyDataSetChanged.implementation = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;notifyDataSetChanged&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> data = <span class="built_in">this</span>.LtF.value;</span><br><span class="line">        <span class="keyword">var</span> data_size = data.size();</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;data_size&quot;</span>,data_size);</span><br><span class="line">        <span class="keyword">for</span>(<span class="keyword">var</span> i=<span class="number">0</span>;i&lt;data_size;++i)&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;Message&quot;</span>+i,Java.cast(data.get(i),Java.use(<span class="string">&quot;com.tencent.mm.storage.bz&quot;</span>)).field_content.value);</span><br><span class="line">        &#125;</span><br><span class="line">        Java.cast(data.get(<span class="number">5</span>),Java.use(<span class="string">&quot;com.tencent.mm.storage.bz&quot;</span>)).field_content.value = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;heheheheh&quot;</span>);</span><br><span class="line">         <span class="keyword">return</span> clazz.notifyDataSetChanged.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p>运行脚本之前的界面</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/img-1629011094588.png" alt="img"></p>
<p>可以得到以下输出</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">notifyDataSetChanged</span><br><span class="line">data_size 7</span><br><span class="line">Message0 1</span><br><span class="line">Message1 2</span><br><span class="line">Message2 3</span><br><span class="line">Message3 4</span><br><span class="line">Message4 5</span><br><span class="line">Message5 哈哈哈哈哈哈哈哈哈哈哈哈</span><br><span class="line">Message6 6</span><br></pre></td></tr></table></figure>
<p>同时界面被修改为了</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/img-1629011192790.png" alt="img"></p>
<p>当然只能修改本地数据（虽然没什么卵用）</p>
<p>同时json输出该消息的数据结构为</p>
<figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// com.tencent.mm.storage.bz</span></span><br><span class="line">&#123;</span><br><span class="line">    <span class="attr">&quot;KzF&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;KzG&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;Zq&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;__hadSetcreateTime&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;__hadSettype&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;dvP&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;eBD&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eBO&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eBf&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEH&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;eEI&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;eEL&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEM&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEN&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEO&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEP&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEQ&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eER&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eES&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEf&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEg&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEh&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEi&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEj&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;eEq&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;ewj&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">    <span class="attr">&quot;ewq&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;exe&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">    <span class="attr">&quot;fdE&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;fdF&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">    <span class="attr">&quot;fdI&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;fdJ&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdK&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdL&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdM&quot;</span>: <span class="number">1</span>,</span><br><span class="line">    <span class="attr">&quot;fdN&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdO&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdP&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;fdQ&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;fdR&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;fdS&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdT&quot;</span>: [],</span><br><span class="line">    <span class="attr">&quot;fdU&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;fdV&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;fdW&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;fdX&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;field_bizChatId&quot;</span>: <span class="number">-1</span>,</span><br><span class="line">    <span class="attr">&quot;field_bizClientMsgId&quot;</span>: <span class="string">&quot;&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;field_content&quot;</span>: <span class="string">&quot;&quot;</span>,            <span class="comment">// 聊天内容</span></span><br><span class="line">    <span class="attr">&quot;field_createTime&quot;</span>: <span class="number">1629009756000</span>,      <span class="comment">// 聊天时间戳</span></span><br><span class="line">    <span class="attr">&quot;field_flag&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;field_isSend&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;field_isShowTimer&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;field_lvbuffer&quot;</span>: [<span class="number">0</span>, <span class="number">0</span>, <span class="number">125</span>],</span><br><span class="line">    <span class="attr">&quot;field_msgId&quot;</span>: <span class="number">00</span>,                      <span class="comment">// 消息id</span></span><br><span class="line">    <span class="attr">&quot;field_msgSeq&quot;</span>: <span class="number">000000000</span>,</span><br><span class="line">    <span class="attr">&quot;field_msgSvrId&quot;</span>: <span class="number">4746617000000000000</span>,</span><br><span class="line">    <span class="attr">&quot;field_status&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;field_talker&quot;</span>: <span class="string">&quot;wxid_00000000000000&quot;</span>,  <span class="comment">// 对话的微信用户ida</span></span><br><span class="line">    <span class="attr">&quot;field_talkerId&quot;</span>: <span class="number">00</span>,</span><br><span class="line">    <span class="attr">&quot;field_type&quot;</span>: <span class="number">1</span>,</span><br><span class="line">    <span class="attr">&quot;systemRowid&quot;</span>: <span class="number">-1</span></span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p>其中接收到的消息比发送的消息要多了几个字段（普通文本消息）</p>
<h3 id="类总结">类总结<a class="header-anchor" href="#类总结"> ¶ </a></h3>
<p>因此可以分析到聊天窗口UI以及数据的类为</p>
<table>
<thead>
<tr>
<th>描述</th>
<th>类名</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>Fragment</code></td>
<td><code>com.tencent.mm.ui.chatting.ChattingUIFragment</code></td>
</tr>
<tr>
<td><code>ListView</code></td>
<td><code>com.tencent.mm.ui.chatting.view.MMChattingListView</code></td>
</tr>
<tr>
<td><code>Adapter</code></td>
<td><code>com.tencent.mm.ui.chatting.a.a</code></td>
</tr>
<tr>
<td>单条消息类</td>
<td><code>com.tencent.mm.storage.bz</code></td>
</tr>
<tr>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
</tr>
</tbody>
</table>
<h2 id="vx投骰子">vx投骰子<a class="header-anchor" href="#vx投骰子"> ¶ </a></h2>
<h3 id="分析-2">分析<a class="header-anchor" href="#分析-2"> ¶ </a></h3>
<p>先用DDMS的记录功能找到点击事件为<code>com.tencent.mm.emoji.panel.a.q$1.onClick()</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816123125656.png" alt="image-20210816123125656"></p>
<p>随后进入了<code>glG.a</code>方法，也就是<code>com.tencent.mm.emoji.panel.a.d.a()</code>方法</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816123331547.png" alt="image-20210816123331547"></p>
<p>frida调试<code>arg14.type</code>一直等于0</p>
<p>刚开始没咋看代码，然后去了<code>v0_2.A(v6)</code>方法，然后找了三四层。😕后来发现里面的有的方法不止是投骰子的时候才被调用才发觉找错了。</p>
<p>然后frida查看了一下<code>v1.getGroup()</code>，发现我添加的自定义表情是<code>81</code>，而骰子和石头剪刀布都是<code>18</code>；同时<code>EmojiGroupInfo.Qbd</code>也为<code>18</code></p>
<p>然后分析<code>.getProvider().p(v1)</code>方法，交叉引用有多个，分别是<code>com.tencent.mm.ca.a.p()</code>和<code>com.tencent.mm.plugin.emoji.e.f.p()</code></p>
<p>frida打印调用信息发现<code>com.tencent.mm.ca.a.p()</code>先被调用</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816124809022.png" alt="image-20210816124809022"></p>
<p>frida调试发现进入了<code>getEmojiMgr().p(arg9)</code>方法，也就是<code>com.tencent.mm.plugin.emoji.e.f.p()</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816130822813.png" alt="image-20210816130822813"></p>
<p>Cursor是数据库的游标，通过<code>aec</code>方法来查询相应内容</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816132210776.png" alt="image-20210816132210776"></p>
<p>然后<code>v0.moveToPosition(v1)</code>让游标v0移动到v1位置</p>
<p><code>arg6.convertFrom(v0)</code>这个方法，位于<code>EmojiInfo</code>的父类<code>com.tencent.mm.g.c.bj</code>，查询该行相应的值然后给字段赋值</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816132511952.png" alt="image-20210816132511952"></p>
<p>之后发送的emoji表情就是这个<code>arg6</code>了</p>
<p>所以看<code>int v1 = bu.jE(v0.getCount() - 1, 0);</code></p>
<p>frida得到，石头剪刀布<code>getCount()</code>为3；而投骰子<code>getCount()</code>为6</p>
<p>查看<code>com.tencent.mm.sdk.platformtools.bu.jE()</code>方法</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816132833909.png" alt="image-20210816132833909"></p>
<blockquote>
<p>public int nextInt(int n)</p>
<p>该方法的作用是生成一个随机的int值,该值介于[0,n)的区间,也就是0到n之间的随机int值,包含0而不包含n。</p>
</blockquote>
<p><code>arg6</code>是恒为0的。也就是说返回的v0是介于<code>[0,arg5]</code>的。</p>
<p>经Frida调试，骰子点数1-6对应着0-5；剪刀石头布分别对应着0 1 2</p>
<p>若想修改相应点数，直接hook该函数返回值就好</p>
<p>相应堆栈信息</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">com.tencent.mm.sdk.platformtools.bu.jE(Native Method)</span><br><span class="line">com.tencent.mm.plugin.emoji.e.f.p(SourceFile:91)</span><br><span class="line">com.tencent.mm.plugin.emoji.e.f.p(Native Method)</span><br><span class="line">com.tencent.mm.ca.a.p(SourceFile:240)</span><br><span class="line">com.tencent.mm.ca.a.p(Native Method)</span><br><span class="line">com.tencent.mm.emoji.panel.a.d.a(SourceFile:66)</span><br><span class="line">com.tencent.mm.emoji.panel.a.d.a(Native Method)</span><br><span class="line">com.tencent.mm.emoji.panel.a.q<span class="variable">$1</span>.onClick(SourceFile:41)</span><br><span class="line">android.view.View.performClick(View.java:6294)</span><br><span class="line">android.view.View<span class="variable">$PerformClick</span>.run(View.java:24770)</span><br><span class="line">android.os.Handler.handleCallback(Handler.java:790)</span><br><span class="line">android.os.Handler.dispatchMessage(Handler.java:99)</span><br><span class="line">android.os.Looper.loop(Looper.java:164)</span><br><span class="line">android.app.ActivityThread.main(ActivityThread.java:6494)</span><br><span class="line">java.lang.reflect.Method.invoke(Native Method)</span><br><span class="line">com.android.internal.os.RuntimeInit<span class="variable">$MethodAndArgsCaller</span>.run(RuntimeInit.java:438)</span><br><span class="line">com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)</span><br></pre></td></tr></table></figure>
<h3 id="脚本实现-2">脚本实现<a class="header-anchor" href="#脚本实现-2"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.sdk.platformtools.bu&#x27;</span>);</span><br><span class="line">    clazz.jE.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">for</span>(<span class="keyword">var</span> i=<span class="number">0</span>;i&lt;<span class="built_in">arguments</span>.length;i++)&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;bu.jE arguments&quot;</span>+i,<span class="built_in">arguments</span>[i]);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> result = clazz.jE.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">        <span class="keyword">if</span>(<span class="built_in">arguments</span>[<span class="number">0</span>]==<span class="number">2</span>)&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;石头剪刀布结果为:&quot;</span>,result==<span class="number">0</span>?<span class="string">&quot;剪刀&quot;</span>:result==<span class="number">1</span>?<span class="string">&quot;石头&quot;</span>:<span class="string">&quot;布&quot;</span>);</span><br><span class="line">        &#125;<span class="keyword">else</span>&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;骰子点数为:&quot;</span>,result+<span class="number">1</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="comment">// 进行修改</span></span><br><span class="line">        <span class="comment">// result = Java.use(&quot;java.lang.Integer&quot;).parseInt(&quot;1&quot;);</span></span><br><span class="line">        <span class="keyword">return</span> result;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<h2 id="vx防撤回">vx防撤回<a class="header-anchor" href="#vx防撤回"> ¶ </a></h2>
<h3 id="分析-3">分析<a class="header-anchor" href="#分析-3"> ¶ </a></h3>
<p>防撤回难点是监听消息啥时候发送过来，真没啥思路。刚开始从聊天页面的ListView的<code>notifyDataSetChanged</code>开始回溯，回溯了好久找不到。</p>
<p>就搜索Log日志<code>revoke</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816160615130.png" alt="image-20210816160615130"></p>
<p>然后去类中搜索字符串定位到<code>com.tencent.mm.plugin.msgquote.PluginMsgQuote.handleRevokeMsgBySvrId</code></p>
<p>打印一下堆栈信息</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">com.tencent.mm.plugin.msgquote.PluginMsgQuote.handleRevokeMsgBySvrId(Native Method)</span><br><span class="line">com.tencent.mm.model.f.a(SourceFile:2190)</span><br><span class="line">com.tencent.mm.model.ch.b(SourceFile:258)</span><br><span class="line">com.tencent.mm.s.b.b(SourceFile:40)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.c.processAddMsg(SourceFile:165)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.c.a(SourceFile:1059)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.f.a(SourceFile:118)</span><br><span class="line">com.tencent.mm.plugin.zero.c.a(SourceFile:57)</span><br><span class="line">com.tencent.mm.modelmulti.q$a$1.onTimerExpired(SourceFile:830)</span><br><span class="line">com.tencent.mm.sdk.platformtools.aw.handleMessage(SourceFile:86)</span><br><span class="line">com.tencent.mm.sdk.platformtools.aq$2.handleMessage(SourceFile:362)</span><br><span class="line">android.os.Handler.dispatchMessage(Handler.java:106)</span><br><span class="line">com.tencent.mm.sdk.platformtools.aq$2.dispatchMessage(SourceFile:350)</span><br><span class="line">android.os.Looper.loop(Looper.java:164)</span><br><span class="line">android.os.HandlerThread.run(HandlerThread.java:65)</span><br></pre></td></tr></table></figure>
<p>之后写出如下frida脚本</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.plugin.msgquote.PluginMsgQuote&#x27;</span>);</span><br><span class="line">    clazz.handleRevokeMsgBySvrId.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;8 handleRevokeMsgBySvrId&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.handleRevokeMsgBySvrId.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.model.f&#x27;</span>);</span><br><span class="line">    clazz.a.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;7 f.a()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.a.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.model.ch&#x27;</span>);</span><br><span class="line">    clazz.b.overload(<span class="string">&#x27;com.tencent.mm.ak.e$a&#x27;</span>).implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;6 ch.b()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.b.overload(<span class="string">&#x27;com.tencent.mm.ak.e$a&#x27;</span>).apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.s.b&#x27;</span>);</span><br><span class="line">    clazz.b.overload(<span class="string">&#x27;com.tencent.mm.ak.e$a&#x27;</span>).implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;5 b.b()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.b.overload(<span class="string">&#x27;com.tencent.mm.ak.e$a&#x27;</span>).apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.plugin.messenger.foundation.c&#x27;</span>);</span><br><span class="line">    clazz.processAddMsg.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;4 c.processAddMsg()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.processAddMsg.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.plugin.messenger.foundation.c&#x27;</span>);</span><br><span class="line">    clazz.a.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;3 c.a()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.a.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.plugin.messenger.foundation.f&#x27;</span>);</span><br><span class="line">    clazz.a.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;2 f.a()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.a.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.plugin.zero.c&#x27;</span>);</span><br><span class="line">    clazz.a.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;1 c.a()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.a.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p>对方发送一条消息</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">1 c.a() arguments: [0]com.tencent.mm.protocal.protobuf.aaf@84db3f8 [1]false</span><br><span class="line">2 f.a() arguments: [0]com.tencent.mm.protocal.protobuf.aaf@84db3f8 [1][object Object] [2]false</span><br><span class="line">3 c.a() arguments: [0]com.tencent.mm.protocal.protobuf.aaf@84db3f8 [1][object Object] [2]false [3][object Object]</span><br><span class="line">4 c.processAddMsg() arguments: [0]AddMsgInfo(263938257), get[false], fault[false], up[false] fixTime[0] [1][object Object]</span><br></pre></td></tr></table></figure>
<p>对方撤回该消息</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">1 c.a() arguments: [0]com.tencent.mm.protocal.protobuf.aaf@d4208e1 [1]false</span><br><span class="line">2 f.a() arguments: [0]com.tencent.mm.protocal.protobuf.aaf@d4208e1 [1][object Object] [2]false</span><br><span class="line">3 c.a() arguments: [0]com.tencent.mm.protocal.protobuf.aaf@d4208e1 [1][object Object] [2]false [3][object Object]</span><br><span class="line">4 c.processAddMsg() arguments: [0]AddMsgInfo(47744518), get[false], fault[false], up[false] fixTime[0] [1][object Object]</span><br><span class="line">5 b.b() arguments: [0]AddMsgInfo(47744518), get[false], fault[false], up[false] fixTime[0]</span><br><span class="line">6 ch.b() arguments: [0]AddMsgInfo(47744518), get[false], fault[false], up[false] fixTime[0]</span><br><span class="line">7 f.a() arguments: [0]revokemsg [1][object Object] [2]AddMsgInfo(47744518), get[false], fault[false], up[false] fixTime[0]</span><br><span class="line">8 handleRevokeMsgBySvrId arguments: [0]796494781522958800</span><br></pre></td></tr></table></figure>
<h4 id="4-c-processAddMsg">4 c.processAddMsg()<a class="header-anchor" href="#4-c-processAddMsg"> ¶ </a></h4>
<p>发现是从<code>processAddMsg()</code>方法开始不一样的，也就是最先在这里判断是否为撤回消息的</p>
<p>而判断是否进入第五层的消息是靠<code>v2!=null</code>来判断的，而v2来自<code>v3.vkP</code>，v3来自参数一<code>arg10.gpg</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816201709925.png" alt="image-20210816201709925"></p>
<p>经调试，普通文本消息的<code>v3.vkP</code>为<code>1</code>，而撤回消息的<code>v3.vkP</code>为<code>10002</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816210123382.png" alt="image-20210816210123382"></p>
<p>而这恰好有个<code>10002</code>，不过并没有详细分析这里</p>
<h4 id="5-b-b">5 b.b()<a class="header-anchor" href="#5-b-b"> ¶ </a></h4>
<p>进入调用的<code>b(arg10)</code>方法，也就是<code>com.tencent.mm.s.b.b()</code>没发现啥东西</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816210228078.png" alt="image-20210816210228078"></p>
<p><strong>因为正常消息不会执行这个方法，当直接将该方法替换为空的时候，已经可以实现防撤回</strong>😂暴力yyds，但是没有撤回提示，还得继续分析</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/Image-20210816211759.jpg" alt="Image-20210816211759"></p>
<h4 id="6-ch-b">6 ch.b()<a class="header-anchor" href="#6-ch-b"> ¶ </a></h4>
<p>直接进入下一层<code>com.tencent.mm.model.ch.b</code>方法，在一开始又对<code>.vkP</code>做了一次判断</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816210702683.png" alt="image-20210816210702683"></p>
<p>至于<code>10001</code>暂不知作用。对于<code>10001</code>只有那一点处理，之后就<code>return null</code>了；而default分支最后也是<code>return null</code>，可以得知<code>.vkp</code>的含义是<code>msgType</code></p>
<p>可以知道这一个函数都是对撤回消息也就是<code>msgType==10002</code>进行处理的</p>
<p>然后该方法下面都是对v5的判断逻辑，而<code>v5=v0.GYI.IYz</code></p>
<p>将<code>v0.GYI</code>json化输出，得到</p>
<figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// com.tencent.mm.protocal.protobuf.cv</span></span><br><span class="line">&#123;</span><br><span class="line">    <span class="attr">&quot;CreateTime&quot;</span>: <span class="number">1629120000</span>,</span><br><span class="line">    <span class="attr">&quot;GYG&quot;</span>: &#123;</span><br><span class="line">        <span class="attr">&quot;IYA&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">        <span class="attr">&quot;IYz&quot;</span>: <span class="string">&quot;wxid_00000000000000&quot;</span>,</span><br><span class="line">        <span class="attr">&quot;includeUnKnownField&quot;</span>: <span class="literal">false</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="attr">&quot;GYH&quot;</span>: &#123;</span><br><span class="line">        <span class="attr">&quot;IYA&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">        <span class="attr">&quot;IYz&quot;</span>: <span class="string">&quot;wxid_00000000000000&quot;</span>,</span><br><span class="line">        <span class="attr">&quot;includeUnKnownField&quot;</span>: <span class="literal">false</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="attr">&quot;GYI&quot;</span>: &#123;</span><br><span class="line">        <span class="attr">&quot;IYA&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">        <span class="attr">&quot;IYz&quot;</span>: <span class="string">&quot;\u003csysmsg type\u003d\&quot;revokemsg\&quot;\u003e\n\t\u003crevokemsg\u003e\n\t\t\u003csession\u003ewxid_00000000000000\u003c/session\u003e\n\t\t\u003cmsgid\u003e1070000000\u003c/msgid\u003e\n\t\t\u003cnewmsgid\u003e600000000000000\u003c/newmsgid\u003e\n\t\t\u003creplacemsg\u003e\u003c![CDATA[\&quot;Forgo7ten.\&quot; 撤回了一条消息]]\u003e\u003c/replacemsg\u003e\n\t\u003c/revokemsg\u003e\n\u003c/sysmsg\u003e\n&quot;</span>,</span><br><span class="line">        <span class="attr">&quot;includeUnKnownField&quot;</span>: <span class="literal">false</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="attr">&quot;GYJ&quot;</span>: <span class="number">1</span>,</span><br><span class="line">    <span class="attr">&quot;GYK&quot;</span>: &#123;</span><br><span class="line">        <span class="attr">&quot;hasBuffer&quot;</span>: <span class="literal">false</span>,</span><br><span class="line">        <span class="attr">&quot;hasILen&quot;</span>: <span class="literal">true</span>,</span><br><span class="line">        <span class="attr">&quot;iLen&quot;</span>: <span class="number">0</span>,</span><br><span class="line">        <span class="attr">&quot;includeUnKnownField&quot;</span>: <span class="literal">false</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="attr">&quot;GYN&quot;</span>: <span class="number">656800000</span>,</span><br><span class="line">    <span class="attr">&quot;nNf&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="attr">&quot;vkP&quot;</span>: <span class="number">10002</span>,</span><br><span class="line">    <span class="attr">&quot;ysP&quot;</span>: <span class="number">1073900000</span>,</span><br><span class="line">    <span class="attr">&quot;ysR&quot;</span>: <span class="number">2498250000000000000</span>,</span><br><span class="line">    <span class="attr">&quot;data&quot;</span>: [<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>,<span class="number">0</span>],      <span class="comment">// 这些消息的字节数据</span></span><br><span class="line">    <span class="attr">&quot;includeUnKnownField&quot;</span>: <span class="literal">false</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>而v5也就是</p>
<figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">sysmsg</span> <span class="attr">type</span>=<span class="string">&quot;revokemsg&quot;</span>&gt;</span></span><br><span class="line">        <span class="tag">&lt;<span class="name">revokemsg</span>&gt;</span></span><br><span class="line">                <span class="tag">&lt;<span class="name">session</span>&gt;</span>wxid_##############<span class="tag">&lt;/<span class="name">session</span>&gt;</span></span><br><span class="line">                <span class="tag">&lt;<span class="name">msgid</span>&gt;</span>10739#####<span class="tag">&lt;/<span class="name">msgid</span>&gt;</span></span><br><span class="line">                <span class="tag">&lt;<span class="name">newmsgid</span>&gt;</span>7829338############<span class="tag">&lt;/<span class="name">newmsgid</span>&gt;</span></span><br><span class="line">                <span class="tag">&lt;<span class="name">replacemsg</span>&gt;</span>&lt;![CDATA[&quot;Forgo7ten.&quot; 撤回了一条消息]]&gt;<span class="tag">&lt;/<span class="name">replacemsg</span>&gt;</span></span><br><span class="line">        <span class="tag">&lt;/<span class="name">revokemsg</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">sysmsg</span>&gt;</span></span><br></pre></td></tr></table></figure>
<p>尝试一下修改信息</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">modify_revoke_str</span>(<span class="params">old_revoke_str</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> message = <span class="string">&quot;尝试撤回了一条消息&quot;</span>;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> revoke_msg = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(message);</span><br><span class="line">    <span class="keyword">var</span> sub_str = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;]]&gt;&lt;/replacemsg&gt;&quot;</span>)</span><br><span class="line">    <span class="keyword">var</span> index = old_revoke_str.indexOf(sub_str);</span><br><span class="line">    <span class="keyword">var</span> new_revoke_str = old_revoke_str.substring(<span class="number">0</span>, index - <span class="number">7</span>) + revoke_msg + old_revoke_str.substring(index);</span><br><span class="line">    <span class="keyword">return</span> Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(new_revoke_str);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.openClassFile(<span class="string">&quot;/data/local/tmp/r0gson.dex&quot;</span>).load();</span><br><span class="line">    <span class="keyword">const</span> gson = Java.use(<span class="string">&#x27;com.r0ysue.gson.Gson&#x27;</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.model.ch&#x27;</span>);</span><br><span class="line">    clazz.b.overload(<span class="string">&#x27;com.tencent.mm.ak.e$a&#x27;</span>).implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> log_str = <span class="string">&quot;arguments:&quot;</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">            log_str += <span class="string">&quot; [&quot;</span> + i + <span class="string">&quot;]&quot;</span> + <span class="built_in">arguments</span>[i]</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;====================&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> v0 = Java.cast(<span class="built_in">arguments</span>[<span class="number">0</span>].gpg.value, Java.use(<span class="string">&quot;com.tencent.mm.protocal.protobuf.cv&quot;</span>));</span><br><span class="line">        <span class="built_in">console</span>.log(gson.$new().toJson(v0));</span><br><span class="line"></span><br><span class="line">        <span class="function"><span class="keyword">function</span> <span class="title">modify_revoke_str</span>(<span class="params">old_revoke_str</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> message = <span class="string">&quot;尝试撤回了一条消息&quot;</span>;</span><br><span class="line"></span><br><span class="line">            <span class="keyword">var</span> revoke_msg = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(message);</span><br><span class="line">            <span class="keyword">var</span> sub_str = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;]]&gt;&lt;/replacemsg&gt;&quot;</span>)</span><br><span class="line">            <span class="keyword">var</span> index = old_revoke_str.indexOf(sub_str);</span><br><span class="line">            <span class="keyword">var</span> new_revoke_str = old_revoke_str.substring(<span class="number">0</span>, index - <span class="number">7</span>) + revoke_msg + old_revoke_str.substring(index);</span><br><span class="line">            <span class="keyword">return</span> Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(new_revoke_str);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> revoke_xml_obj = Java.cast(v0.GYI.value, Java.use(<span class="string">&quot;com.tencent.mm.protocal.protobuf.deo&quot;</span>));</span><br><span class="line"></span><br><span class="line">        revoke_xml_obj.IYz.value = modify_revoke_str(revoke_xml_obj.IYz.value);</span><br><span class="line">        <span class="built_in">console</span>.log(revoke_xml_obj.IYz.value);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;====================&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;6 ch.b()&quot;</span>, log_str);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.b.overload(<span class="string">&#x27;com.tencent.mm.ak.e$a&#x27;</span>).apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p>虽然消息还是被撤回了，但也说明这种修改提示信息的方式是可行的</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/img-1629127911174.png" alt="img"></p>
<p>通过hook<code>notifyDataSetChanged</code>，json打印最后一条消息发现</p>
<p>撤回消息与撤回提示，仅有<code>field_content&quot;</code>（文本内容）、<code>&quot;field_type&quot;</code>、<code>&quot;exe&quot;</code>字段不一样</p>
<p>其中正常消息的<code>field_type=1,exe=true</code>；撤回提示<code>field_type=10000,exe=false</code></p>
<p>被撤回消息和撤回消息的提示的<code>field_msgSvrId</code>字段是一样的，同时对应着撤回提示xml的<code>&lt;newmsgid&gt;</code>字段</p>
<p>尝试修改撤回提示的<code>&lt;newmsgid&gt;</code>字段，发现没有什么用。直接就变成不撤回了。</p>
<h5 id="返回该函数的分析">返回该函数的分析<a class="header-anchor" href="#返回该函数的分析"> ¶ </a></h5>
<p>大概是对xml进行分析处理的一些东西</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210816235316259.png" alt="image-20210816235316259"></p>
<p>之后就去了<code>com.tencent.mm.model.f.a()</code>方法</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">public</span> <span class="keyword">final</span> com.tencent.mm.ak.e.<span class="function">b <span class="title">a</span><span class="params">(String arg24, Map arg25, com.tencent.mm.ak.e.a arg26)</span></span>;</span><br></pre></td></tr></table></figure>
<ul>
<li>
<p>参数一为字符串String，获取过程为上图中蓝框</p>
<ul>
<li>即获取的是xml中<code>sysmsg</code>的<code>type</code>属性</li>
<li>撤回消息就为<code>&quot;revokemsg&quot;</code></li>
</ul>
</li>
<li>
<p>参数二是一个XML内容转成的Map数组</p>
<figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">&#123;</span><br><span class="line">    <span class="attr">&quot;.sysmsg.revokemsg.newmsgid&quot;</span>: <span class="string">&quot;4308###############&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;.sysmsg.revokemsg&quot;</span>: <span class="string">&quot;\n\t&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;.sysmsg.revokemsg.session&quot;</span>: <span class="string">&quot;wxid_##############&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;.sysmsg&quot;</span>: <span class="string">&quot;\n&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;.sysmsg.$type&quot;</span>: <span class="string">&quot;revokemsg&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;.sysmsg.revokemsg.replacemsg&quot;</span>: <span class="string">&quot;\&quot;Forgo7ten.\&quot; 撤回了一条消息&quot;</span>,</span><br><span class="line">    <span class="attr">&quot;.sysmsg.revokemsg.msgid&quot;</span>: <span class="string">&quot;##########&quot;</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
</li>
<li>
<p>参数三保存着原始的所有数据</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// com.tencent.mm.ak.e$a</span></span><br><span class="line">&#123;</span><br><span class="line">    <span class="string">&quot;gpg&quot;</span>: &#123;</span><br><span class="line">        <span class="string">&quot;CreateTime&quot;</span>: <span class="number">1629120000</span>,</span><br><span class="line">        <span class="string">&quot;GYG&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;IYA&quot;</span>: <span class="keyword">true</span>,</span><br><span class="line">            <span class="string">&quot;IYz&quot;</span>: <span class="string">&quot;wxid_00000000000000&quot;</span>,</span><br><span class="line">            <span class="string">&quot;includeUnKnownField&quot;</span>: <span class="keyword">false</span></span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="string">&quot;GYH&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;IYA&quot;</span>: <span class="keyword">true</span>,</span><br><span class="line">            <span class="string">&quot;IYz&quot;</span>: <span class="string">&quot;wxid_00000000000000&quot;</span>,</span><br><span class="line">            <span class="string">&quot;includeUnKnownField&quot;</span>: <span class="keyword">false</span></span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="string">&quot;GYI&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;IYA&quot;</span>: <span class="keyword">true</span>,</span><br><span class="line">            <span class="string">&quot;IYz&quot;</span>: <span class="string">&quot;\u003csysmsg type\u003d\&quot;revokemsg\&quot;\u003e\n\t\u003crevokemsg\u003e\n\t\t\u003csession\u003ewxid_00000000000000\u003c/session\u003e\n\t\t\u003cmsgid\u003e1070000000\u003c/msgid\u003e\n\t\t\u003cnewmsgid\u003e600000000000000\u003c/newmsgid\u003e\n\t\t\u003creplacemsg\u003e\u003c![CDATA[\&quot;Forgo7ten.\&quot; 撤回了一条消息]]\u003e\u003c/replacemsg\u003e\n\t\u003c/revokemsg\u003e\n\u003c/sysmsg\u003e\n&quot;</span>,</span><br><span class="line">            <span class="string">&quot;includeUnKnownField&quot;</span>: <span class="keyword">false</span></span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="string">&quot;GYJ&quot;</span>: <span class="number">1</span>,</span><br><span class="line">        <span class="string">&quot;GYK&quot;</span>: &#123;</span><br><span class="line">            <span class="string">&quot;hasBuffer&quot;</span>: <span class="keyword">false</span>,</span><br><span class="line">            <span class="string">&quot;hasILen&quot;</span>: <span class="keyword">true</span>,</span><br><span class="line">            <span class="string">&quot;iLen&quot;</span>: <span class="number">0</span>,</span><br><span class="line">            <span class="string">&quot;includeUnKnownField&quot;</span>: <span class="keyword">false</span></span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="string">&quot;GYN&quot;</span>: <span class="number">656800000</span>,</span><br><span class="line">        <span class="string">&quot;nNf&quot;</span>: <span class="number">0</span>,</span><br><span class="line">        <span class="string">&quot;vkP&quot;</span>: <span class="number">10002</span>,</span><br><span class="line">        <span class="string">&quot;ysP&quot;</span>: <span class="number">1073900000</span>,</span><br><span class="line">        <span class="string">&quot;ysR&quot;</span>: <span class="number">2498250000000000000</span>,</span><br><span class="line">        <span class="string">&quot;data&quot;</span>: [<span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>], <span class="comment">// 这些消息的字节数据</span></span><br><span class="line">        <span class="string">&quot;includeUnKnownField&quot;</span>: <span class="keyword">false</span></span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="string">&quot;hQb&quot;</span>: <span class="keyword">false</span>,</span><br><span class="line">    <span class="string">&quot;hQc&quot;</span>: <span class="keyword">false</span>,</span><br><span class="line">    <span class="string">&quot;hQd&quot;</span>: <span class="keyword">false</span>,</span><br><span class="line">    <span class="string">&quot;hQe&quot;</span>: <span class="number">0</span>,</span><br><span class="line">    <span class="string">&quot;hQf&quot;</span>: <span class="keyword">false</span>,</span><br><span class="line">    <span class="string">&quot;what&quot;</span>: <span class="number">0</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
</li>
</ul>
<h4 id="7-f-a">7 f.a()<a class="header-anchor" href="#7-f-a"> ¶ </a></h4>
<p>这个方法里面是分块对参数一也就是<code>.sysmsg.$type</code>的值进行判断</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210817135838492.png" alt="image-20210817135838492"></p>
<p>之后发现将<code>.a()</code>方法置为空则消息不会撤回，继续跟入</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210817140049459.png" alt="image-20210817140049459"></p>
<p>在里面发现了数据库操作方法update</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210817140125502.png" alt="image-20210817140125502"></p>
<p>之后嵌套了三个update，最后来到了<code>updateWithOnConflict</code>方法</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210817142313024.png" alt="image-20210817142313024"></p>
<p>附上堆栈信息</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line">=============================updateWithOnConflict Stack strat=======================</span><br><span class="line">com.tencent.wcdb.database.SQLiteDatabase.updateWithOnConflict(Native Method)</span><br><span class="line">com.tencent.wcdb.database.SQLiteDatabase.update(SourceFile:1726)</span><br><span class="line">com.tencent.mm.storagebase.f.update(SourceFile:895)</span><br><span class="line">com.tencent.mm.storagebase.h.update(SourceFile:601)</span><br><span class="line">com.tencent.mm.storage.ca.a(SourceFile:2426)</span><br><span class="line">com.tencent.mm.storage.ca.a(Native Method)</span><br><span class="line">com.tencent.mm.model.f.a(SourceFile:2187)</span><br><span class="line">com.tencent.mm.model.f.a(Native Method)</span><br><span class="line">com.tencent.mm.model.ch.b(SourceFile:258)</span><br><span class="line">com.tencent.mm.model.ch.b(Native Method)</span><br><span class="line">com.tencent.mm.s.b.b(SourceFile:40)</span><br><span class="line">com.tencent.mm.s.b.b(Native Method)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.c.processAddMsg(SourceFile:165)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.c.processAddMsg(Native Method)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.c.a(SourceFile:1059)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.c.a(Native Method)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.f.a(SourceFile:118)</span><br><span class="line">com.tencent.mm.plugin.messenger.foundation.f.a(Native Method)</span><br><span class="line">com.tencent.mm.plugin.zero.c.a(SourceFile:57)</span><br><span class="line">com.tencent.mm.plugin.zero.c.a(Native Method)</span><br><span class="line">com.tencent.mm.modelmulti.q$a$1.onTimerExpired(SourceFile:830)</span><br><span class="line">com.tencent.mm.sdk.platformtools.aw.handleMessage(SourceFile:86)</span><br><span class="line">com.tencent.mm.sdk.platformtools.aq$2.handleMessage(SourceFile:362)</span><br><span class="line">android.os.Handler.dispatchMessage(Handler.java:106)</span><br><span class="line">com.tencent.mm.sdk.platformtools.aq$2.dispatchMessage(SourceFile:350)</span><br><span class="line">android.os.Looper.loop(Looper.java:164)</span><br><span class="line">android.os.HandlerThread.run(HandlerThread.java:65)</span><br><span class="line">=============================updateWithOnConflict Stack end=======================</span><br></pre></td></tr></table></figure>
<p>经过一系列分析之后……（其实上面肯定都有分析的，只不过是很杂乱无从记录，这块就简写了</p>
<p>自己撤回消息提示的<code>msgType=10002</code>，别人撤回消息提示的<code>msgType=10000</code></p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.wcdb.database.SQLiteDatabase&#x27;</span>);</span><br><span class="line">    clazz.updateWithOnConflict.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// printStack(&quot;updateWithOnConflict&quot;);</span></span><br><span class="line">        <span class="comment">// var log_str = &quot;arguments:&quot;</span></span><br><span class="line">        <span class="comment">// for (var i = 0; i &lt; arguments.length; i++) &#123;</span></span><br><span class="line">        <span class="comment">//     log_str += &quot; [&quot; + i + &quot;]&quot; + arguments[i]</span></span><br><span class="line">        <span class="comment">// &#125;</span></span><br><span class="line">        <span class="comment">// console.log(&quot;updateWithOnConflict&quot;, log_str);</span></span><br><span class="line">        <span class="keyword">return</span> clazz.updateWithOnConflict.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p><code>updateWithOnConflict()</code>方法将参数进行sql的拼接，然后使用<code>new SQLiteStatement()</code>创建<code>SQLiteStatement</code>对象，再用<code>executeUpdateDelete()</code>来执行</p>
<p>Frida hook一下<code>executeUpdateDelete()</code>方法</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.openClassFile(<span class="string">&quot;/data/local/tmp/r0gson.dex&quot;</span>).load();</span><br><span class="line">    <span class="keyword">const</span> gson = Java.use(<span class="string">&#x27;com.r0ysue.gson.Gson&#x27;</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.wcdb.database.SQLiteStatement&#x27;</span>);</span><br><span class="line">    clazz.executeUpdateDelete.overload().implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line"></span><br><span class="line">        <span class="comment">// console.log(&quot;====================&quot;);</span></span><br><span class="line">        <span class="comment">// console.log(&quot;====================&quot;);</span></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;7.1.1.1 executeUpdateDelete&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;msql:&quot;</span>, <span class="built_in">this</span>.mSql.value, <span class="string">&quot;Args:&quot;</span>, <span class="built_in">this</span>.mBindArgs.value);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">return</span> clazz.executeUpdateDelete.overload().apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<p>当消息被撤回时，得到了以下输出</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">7 f.a() arguments: [0]revokemsg [1][object Object] [2]AddMsgInfo(260954771), get[false], fault[false], up[false] fixTime[0]</span><br><span class="line">7.1 ca.a() arguments: [0]234 [1]com.tencent.mm.storage.bz@8b10ad0</span><br><span class="line">7.1.1 updateWithOnConflict arguments:</span><br><span class="line">7.1.1.1 executeUpdateDelete</span><br><span class="line">msql: UPDATE message SET msgId=?,type=?,content=? WHERE msgId=? Args: 234,10000,&quot;Forgo7ten.&quot; 撤回了一条消息,234</span><br><span class="line">7.1.1 updateWithOnConflict arguments:</span><br><span class="line">7.1.1.1 executeUpdateDelete</span><br><span class="line">msql: UPDATE rconversation SET msgType=?,flag=?,digestUser=?,digest=?,isSend=?,hasTrunc=?,unReadCount=?,conversationTime=?,content=?,username=?,status=? WHERE username=? Args: 10000,1629182140000,,&quot;Forgo7ten.&quot; 撤回了一条消息,0,1,0,1629182140000,&quot;Forgo7ten.&quot; 撤回了一条消息,wxid_00000000000000,3,wxid_00000000000000</span><br><span class="line">7.1.1 updateWithOnConflict arguments:</span><br><span class="line">7.1.1.1 executeUpdateDelete</span><br><span class="line">msql: UPDATE rconversation SET UnReadInvite=?,atCount=? WHERE username= ? Args: 0,0,wxid_00000000000000</span><br></pre></td></tr></table></figure>
<p>而我的目的主要是想 有撤回消息提示，同时不撤回消息</p>
<p>其中的参数<code>msgId</code>是本地的消息id，只有第一条数据库操作指令是<code>WHERE msgId=?</code>的</p>
<p>所以实际上将被撤回消息 替换成撤回提示的就是这一条。</p>
<h3 id="思路">思路<a class="header-anchor" href="#思路"> ¶ </a></h3>
<p>当然 已经找到数据库操作了。。剩下的就想怎么操作就怎么操作了</p>
<p>我想的是 将该条撤回提示直接<code>INSERT</code>进去，不知道<code>msgId</code>会不会重复，重复的话可以挨个调整？（不知道为啥无法使用<code>select count(*)</code>）</p>
<p>或者让提示在指定位置的就是让他被撤回，然后聊天内容添加到撤回提示后边。原聊天内容可以通过<code>select content from message where msgId = ?</code>查询，缺点是只能文字内容；弥补的话只能判断非文本内容不让他撤回了</p>
<p>是想用frida来写的，毕竟frida比较方便。但是构造不出方法参数<code>Object []</code>来。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">Java.array(&quot;Object&quot;,[]);</span><br><span class="line"></span><br><span class="line">var args = Java.use(&quot;java.util.ArrayList&quot;).$new();</span><br><span class="line">args.add(...);</span><br></pre></td></tr></table></figure>
<p>这两种都尝试了，但都会报错</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210817185555176.png" alt="image-20210817185555176"></p>
<p>mark一下，有知道的大佬麻烦分享一下呀。</p>
<h3 id="脚本实现-3">脚本实现<a class="header-anchor" href="#脚本实现-3"> ¶ </a></h3>
<p>这里只用xposed实现了，文本被撤回，但是有撤回提示；图片等等直接暴力不执行方法了…因为撤回提示无法解释图片啥的</p>
<p>效果图</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210817235450332.png" alt="image-20210817235450332"></p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">package</span> com.forgo7ten.vxhook;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> android.util.Log;</span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> de.robv.android.xposed.IXposedHookLoadPackage;</span><br><span class="line"><span class="keyword">import</span> de.robv.android.xposed.XC_MethodHook;</span><br><span class="line"><span class="keyword">import</span> de.robv.android.xposed.XposedBridge;</span><br><span class="line"><span class="keyword">import</span> de.robv.android.xposed.XposedHelpers;</span><br><span class="line"><span class="keyword">import</span> de.robv.android.xposed.callbacks.XC_LoadPackage;</span><br><span class="line"></span><br><span class="line"><span class="keyword">public</span> <span class="class"><span class="keyword">class</span> <span class="title">VxRevoke</span> <span class="keyword">implements</span> <span class="title">IXposedHookLoadPackage</span> </span>&#123;</span><br><span class="line"></span><br><span class="line">    <span class="meta">@Override</span></span><br><span class="line">    <span class="function"><span class="keyword">public</span> <span class="keyword">void</span> <span class="title">handleLoadPackage</span><span class="params">(XC_LoadPackage.LoadPackageParam lpparam)</span> <span class="keyword">throws</span> Throwable </span>&#123;</span><br><span class="line">        <span class="keyword">if</span> (!<span class="string">&quot;com.tencent.mm&quot;</span>.equals(lpparam.packageName)) &#123;</span><br><span class="line">            <span class="keyword">return</span>;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">final</span> String className = <span class="string">&quot;com.tencent.wcdb.database.SQLiteStatement&quot;</span>;</span><br><span class="line">        <span class="keyword">final</span> String methodName = <span class="string">&quot;executeUpdateDelete&quot;</span>;</span><br><span class="line">        Class&lt;?&gt; SDClazz = XposedHelpers.findClass(className, lpparam.classLoader);</span><br><span class="line">        XposedBridge.hookAllMethods(SDClazz, methodName, <span class="keyword">new</span> XC_MethodHook() &#123;</span><br><span class="line">            <span class="meta">@Override</span></span><br><span class="line">            <span class="function"><span class="keyword">protected</span> <span class="keyword">void</span> <span class="title">beforeHookedMethod</span><span class="params">(MethodHookParam param)</span> <span class="keyword">throws</span> Throwable </span>&#123;</span><br><span class="line">                <span class="keyword">super</span>.beforeHookedMethod(param);</span><br><span class="line">                Log.d(<span class="string">&quot;VxHook&quot;</span>, <span class="string">&quot;executeUpdateDelete&quot;</span>);</span><br><span class="line">                Object mDatabase = XposedHelpers.getObjectField(param.thisObject, <span class="string">&quot;mDatabase&quot;</span>);</span><br><span class="line">                String mSql = (String) XposedHelpers.getObjectField(param.thisObject, <span class="string">&quot;mSql&quot;</span>);</span><br><span class="line">                Object[] mBindArgs = (Object[]) XposedHelpers.getObjectField(param.thisObject, <span class="string">&quot;mBindArgs&quot;</span>);</span><br><span class="line">                <span class="keyword">if</span> (<span class="string">&quot;UPDATE message SET msgId=?,type=?,content=? WHERE msgId=?&quot;</span>.equals(mSql) &amp;&amp; ((String) mBindArgs[<span class="number">2</span>]).contains(<span class="string">&quot;撤回了一条消息&quot;</span>)) &#123;</span><br><span class="line">                    Object sm = XposedHelpers.newInstance(lpparam.classLoader.loadClass(<span class="string">&quot;com.tencent.wcdb.database.SQLiteStatement&quot;</span>),</span><br><span class="line">                            mDatabase,</span><br><span class="line">                            <span class="string">&quot;select content from message where msgId = ?&quot;</span>,</span><br><span class="line">                            <span class="keyword">new</span> Object[]&#123;mBindArgs[<span class="number">3</span>]&#125;);</span><br><span class="line">                    String msg = (String) XposedHelpers.callMethod(sm, <span class="string">&quot;simpleQueryForString&quot;</span>);</span><br><span class="line">                    <span class="keyword">if</span> (!msg.contains(<span class="string">&quot;&lt;msg&gt;&quot;</span>)) &#123;</span><br><span class="line">                        mBindArgs[<span class="number">2</span>] = mBindArgs[<span class="number">2</span>] + <span class="string">&quot;:&quot;</span> + msg;</span><br><span class="line">                        Log.d(<span class="string">&quot;VxHook&quot;</span>, <span class="string">&quot;对方撤回了：&quot;</span> + msg);</span><br><span class="line">                    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                        param.setResult(<span class="number">1</span>);</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;);</span><br><span class="line"></span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p>其实也想将被撤回消息下面的每条消息都<code>msgId+1</code>然后将撤回消息<code>insert</code>进去。但是<code>select count(*)</code>不能使用，这块知识掌握也不太熟练，就没实现……</p>
<h2 id="vx自动抢红包">vx自动抢红包<a class="header-anchor" href="#vx自动抢红包"> ¶ </a></h2>
<h3 id="分析-4">分析<a class="header-anchor" href="#分析-4"> ¶ </a></h3>
<h4 id="红包消息监听">红包消息监听<a class="header-anchor" href="#红包消息监听"> ¶ </a></h4>
<p>自动抢红包肯定是先要监听到消息</p>
<p>之前已经分析到数据库，接收到消息肯定要插入或者更新数据库，于是hook了<code>com.tencent.wcdb.database.SQLiteDatabase.insertWithOnConflict</code>和<code>updateWithOnConflict</code>方法。观察接收消息时候的参数</p>
<p>当接收红包的时候，<code>insertWithOnConflict</code>被触发了4次，分别对<code>WalletLuckyMoney</code>,<code>LuckyMoneyDetailOpenRecord</code>,<code>message</code>,<code>AppMessage</code>数据库进行了插入</p>
<p>其中对<code>message</code>数据库操作参数字段</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line">&#123;</span><br><span class="line">	&quot;bizClientMsgId&quot;: &quot;&quot;,</span><br><span class="line">	&quot;talker&quot;: &quot;wxid_&quot;,</span><br><span class="line">	&quot;flag&quot;: 0,</span><br><span class="line">	&quot;bizChatId&quot;: -1,</span><br><span class="line">	&quot;msgId&quot;: 00,</span><br><span class="line">	&quot;type&quot;: 436207665,</span><br><span class="line">	&quot;content&quot;: &quot;&quot;,</span><br><span class="line">	&quot;msgSvrId&quot;: 7222869153754354100,</span><br><span class="line">	&quot;lvbuffer&quot;: [123, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 125],</span><br><span class="line">	&quot;createTime&quot;: 1629,</span><br><span class="line">	&quot;reserved&quot;: &quot;&quot;,</span><br><span class="line">	&quot;imgPath&quot;: &quot;&quot;,</span><br><span class="line">	&quot;talkerId&quot;: 33,</span><br><span class="line">	&quot;isSend&quot;: 0,</span><br><span class="line">	&quot;msgSeq&quot;: 723600000,</span><br><span class="line">	&quot;status&quot;: 3</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>而<code>updateWithOnConflict</code>则被触发了三次，都是对<code>rconversation</code>数据库进行的操作</p>
<p>同时发现，普通消息在插入的时候，插入到<code>message</code>数据库的<code>&quot;type&quot;:1</code>；图片<code>&quot;type&quot;:3</code>；语音<code>&quot;type:34&quot;</code>；撤回消息上面说过了，为<code>&quot;type&quot;:10000</code>(“你领取了xxx的红包”也是这种形式)；红包<code>&quot;type&quot;:436207665</code>；转账<code>&quot;type&quot;:419430449</code></p>
<p>同时发现了语音文件是藏在<code>/storage/emulated/0/Android/data/com.tencent.mm/MicroMsg/####/voice2/##/##/msg_###.amr</code>下，不知道为啥打不开</p>
<p>打开红包的时候，聊天界面也就是<code>message</code>数据库插入了一条消息<code>&quot;领取了xxx的红包&quot;</code>同时向<code>WalletLuckyMoney</code>数据库插入了两条消息</p>
<p>其中一条消息有<code>&quot;receiveTime&quot;: ,&quot;hbType&quot;:0,&quot;receiveAmount&quot;:1,&quot;receiveStatus&quot;:2,&quot;hbStatus&quot;:4,&quot;mNativeUrl&quot;:</code>等参数，而且如果点开了红包没有点击【开】按钮选择关闭的话，仍会插入上述参数，只是<code>&quot;receiveTime&quot;:0,&quot;hbType&quot;:0,&quot;receiveAmount&quot;:0,&quot;receiveStatus&quot;:0,&quot;hbStatus&quot;:2,&quot;mNativeUrl&quot;:</code></p>
<h4 id="红包流程分析">红包流程分析<a class="header-anchor" href="#红包流程分析"> ¶ </a></h4>
<p>还是先DDMS寻找按钮点击事件，发现在聊天页面点击红包消息触发的方法为<code>com.tencent.mm.ui.chatting.t$e.onClick()</code></p>
<p>最后在<code>onDone</code>方法里调用了<code>startActivity</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210818172734198.png" alt="image-20210818172734198"></p>
<p>堆栈信息为</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line">com.tencent.mm.br.d$9.onDone(Native Method)</span><br><span class="line">com.tencent.mm.br.d.a(SourceFile:909)</span><br><span class="line">com.tencent.mm.br.d.b(SourceFile:267)</span><br><span class="line">com.tencent.mm.br.d.a(SourceFile:148)</span><br><span class="line">com.tencent.mm.br.d.b(SourceFile:129)</span><br><span class="line">com.tencent.mm.ui.chatting.viewitems.g$b.c(SourceFile:728)</span><br><span class="line">com.tencent.mm.ui.chatting.viewitems.d$d.a(SourceFile:582)</span><br><span class="line">com.tencent.mm.ui.chatting.t$e.onClick(SourceFile:804)</span><br><span class="line">com.tencent.mm.ui.chatting.t$e.onClick(Native Method)</span><br><span class="line">android.view.View.performClick(View.java:6294)</span><br><span class="line">android.view.View$PerformClick.run(View.java:24770)</span><br><span class="line">android.os.Handler.handleCallback(Handler.java:790)</span><br><span class="line">android.os.Handler.dispatchMessage(Handler.java:99)</span><br><span class="line">android.os.Looper.loop(Looper.java:164)</span><br><span class="line">android.app.ActivityThread.main(ActivityThread.java:6494)</span><br><span class="line">java.lang.reflect.Method.invoke(Native Method)</span><br><span class="line">com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)</span><br><span class="line">com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)</span><br></pre></td></tr></table></figure>
<p>其中<code>com.tencent.mm.ui.chatting.viewitems.g$b.c</code>中的判断，这个url是收到红包时插入<code>WalletLuckyMoney</code>数据库中的那条</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210818221446826.png" alt="image-20210818221446826"></p>
<p>在<code>com.tencent.mm.br.d.b(android.content.Context, java.lang.String, java.lang.String, android.content.Intent) : void</code>截取一下<code>intent</code>的参数</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">&#123;</span><br><span class="line">    &quot;key_msgid&quot;: 0, </span><br><span class="line">    &quot;key_material_flag&quot;: 0, </span><br><span class="line">    &quot;key_has_story&quot;: false, </span><br><span class="line">    &quot;key_way&quot;: 1, </span><br><span class="line">    &quot;scene_id&quot;: 0, </span><br><span class="line">    &quot;key_cropname&quot;: &quot;&quot;, </span><br><span class="line">    &quot;key_native_url&quot;: &quot;wxpay://c2cbizmessagehandler/hongbao/receivehongbao?msgtype&quot;, </span><br><span class="line">    &quot;key_emoji_md5&quot;: &quot;&quot;, </span><br><span class="line">    &quot;key_receive_envelope_md5&quot;: &quot;&quot;, </span><br><span class="line">    &quot;key_receive_envelope_url&quot;: &quot;&quot;, </span><br><span class="line">    &quot;key_detail_envelope_md5&quot;: &quot;&quot;, </span><br><span class="line">    &quot;key_detail_envelope_url&quot;: &quot;&quot;, </span><br><span class="line">    &quot;key_username&quot;: &quot;wxid_00000000000000&quot;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>而红包界面的【开】按钮是在<code>LuckyMoneyNotHookReceiveUI$10.onClick()</code>这里触发的</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/image-20210818214917150.png" alt="image-20210818214917150"></p>
<p>然后进入了<code>auQ()</code>方法</p>
<p>监听红包消息，然后让软件执行这些流程。我分析了一些，没有找到最直接的控制红包入账的方法（😂分析躁了，开学补考得开始复习了）</p>
<h3 id="思路-2">思路<a class="header-anchor" href="#思路-2"> ¶ </a></h3>
<p>这里参考了<a target="_blank" rel="noopener" href="https://github.com/skyun1314/WeChat-plug-in">skyun1314/WeChat-plug-in (github.com)</a></p>
<p>监听<code>insertWithOnConflict</code>方法，当接收到红包消息的时候，先使用<code>com.tencent.mm.br.d.b(android.content.Context, java.lang.String, java.lang.String, android.content.Intent) : void</code>这个静态方法初始化<code>LuckyMoneyNotHookReceiveUI</code>，然后监听<code>onCreate()</code>方法，来执行<code>this.wrX</code>按钮的点击事件。</p>
<h3 id="脚本实现-4">脚本实现<a class="header-anchor" href="#脚本实现-4"> ¶ </a></h3>
<p>这样实现的缺点是会弹窗……，如果想实现不弹窗，估计要继续追着【开】按钮<code>onClick</code>方法进去找最主要的那个方法了😲😪</p>
<h4 id="效果图">效果图<a class="header-anchor" href="#效果图"> ¶ </a></h4>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Analysis_of_WeChat/auto_luckymoney.gif" alt="auto_luckymoney"></p>
<p>输出</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">收到红包</span><br><span class="line">find instance :com.tencent.mm.ui.chatting.e.a@df7c891</span><br><span class="line">content = com.tencent.mm.ui.LauncherUI@f03a980</span><br><span class="line">click result: true</span><br><span class="line">click result: true</span><br><span class="line">click result: true</span><br></pre></td></tr></table></figure>
<h4 id="代码实现">代码实现<a class="header-anchor" href="#代码实现"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        Java.openClassFile(<span class="string">&quot;/data/local/tmp/r0gson.dex&quot;</span>).load();</span><br><span class="line">        <span class="keyword">const</span> gson = Java.use(<span class="string">&#x27;com.r0ysue.gson.Gson&#x27;</span>);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.wcdb.database.SQLiteDatabase&#x27;</span>);</span><br><span class="line">        clazz.insertWithOnConflict.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="comment">// console.log(&quot;insertWithOnConflict&quot;);</span></span><br><span class="line">            <span class="comment">// console.log(&quot;[0]&quot;+arguments[0],&quot;[1]&quot;+arguments[1],&quot;[2]&quot;+gson.$new().toJson(arguments[2]));</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">            <span class="keyword">if</span> (<span class="built_in">arguments</span>[<span class="number">0</span>] == <span class="string">&quot;message&quot;</span>) &#123;</span><br><span class="line">                <span class="keyword">var</span> values = Java.cast(<span class="built_in">arguments</span>[<span class="number">2</span>], Java.use(<span class="string">&quot;android.content.ContentValues&quot;</span>));</span><br><span class="line">                <span class="keyword">var</span> msg_type = values.get(<span class="string">&quot;type&quot;</span>);</span><br><span class="line">                <span class="keyword">if</span> (msg_type == <span class="string">&quot;436207665&quot;</span>) &#123;</span><br><span class="line">                    <span class="built_in">console</span>.log(<span class="string">&quot;收到红包&quot;</span>);</span><br><span class="line">                    <span class="keyword">var</span> content;</span><br><span class="line">                    Java.choose(<span class="string">&quot;com.tencent.mm.ui.chatting.e.a&quot;</span>, &#123;</span><br><span class="line">                        <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">x</span>) </span>&#123;</span><br><span class="line">                            <span class="built_in">console</span>.log(<span class="string">&quot;find instance :&quot;</span> + x);</span><br><span class="line">                            content = x.LDE.value.getContext();</span><br><span class="line">                            <span class="built_in">console</span>.log(<span class="string">&quot;content =&quot;</span>, content);</span><br><span class="line">                        &#125;,</span><br><span class="line">                        <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                        &#125;</span><br><span class="line">                    &#125;);</span><br><span class="line">                    open_luck_money(content, values);</span><br><span class="line"></span><br><span class="line">                    <span class="comment">// var intent = Java.cast(arguments[2],Java.use(&quot;android.content.Intent&quot;));</span></span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (msg_type == <span class="string">&quot;419430449&quot;</span>) &#123;</span><br><span class="line">                    <span class="built_in">console</span>.log(<span class="string">&quot;收到转账&quot;</span>);</span><br><span class="line">                &#125;</span><br><span class="line"></span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">return</span> clazz.insertWithOnConflict.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;);</span><br><span class="line"></span><br><span class="line">    <span class="function"><span class="keyword">function</span> <span class="title">open_luck_money</span>(<span class="params">content, values</span>) </span>&#123;</span><br><span class="line">        <span class="function"><span class="keyword">function</span> <span class="title">xml_get_value</span>(<span class="params">content, start, end</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> javaString = Java.use(<span class="string">&quot;java.lang.String&quot;</span>);</span><br><span class="line">            <span class="keyword">var</span> str_start = javaString.$new(start);</span><br><span class="line">            <span class="keyword">var</span> str_end = javaString.$new(end);</span><br><span class="line">            <span class="keyword">var</span> str_content = javaString.$new(content);</span><br><span class="line">            <span class="keyword">var</span> start_index = str_content.indexOf(str_start);</span><br><span class="line">            <span class="keyword">var</span> end_index = str_content.indexOf(str_end);</span><br><span class="line">            <span class="keyword">var</span> result = str_content.substring(start_index+str_start.length(),end_index);</span><br><span class="line">            <span class="keyword">return</span> result;</span><br><span class="line"></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> javaString = Java.use(<span class="string">&quot;java.lang.String&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> intent = Java.use(<span class="string">&quot;android.content.Intent&quot;</span>).$new();</span><br><span class="line">        <span class="keyword">var</span> v_content = values.get(<span class="string">&quot;content&quot;</span>);</span><br><span class="line">        intent.putExtra(javaString.$new(<span class="string">&quot;key_msgid&quot;</span>), Java.use(<span class="string">&quot;java.lang.Long&quot;</span>).parseLong(<span class="string">&quot;&quot;</span>+values.get(<span class="string">&quot;msgId&quot;</span>)));</span><br><span class="line">        intent.putExtra(javaString.$new(<span class="string">&quot;key_way&quot;</span>), Java.use(<span class="string">&quot;java.lang.Integer&quot;</span>).parseInt(<span class="string">&quot;1&quot;</span>));</span><br><span class="line">        intent.putExtra(javaString.$new(<span class="string">&quot;key_has_story&quot;</span>), Java.use(<span class="string">&quot;java.lang.Boolean&quot;</span>).FALSE.value);</span><br><span class="line">        intent.putExtra(javaString.$new(<span class="string">&quot;key_username&quot;</span>), javaString.$new(values.get(<span class="string">&quot;talker&quot;</span>)));</span><br><span class="line">        intent.putExtra(javaString.$new(<span class="string">&quot;key_native_url&quot;</span>), javaString.$new(xml_get_value(v_content,<span class="string">&quot;&lt;nativeurl&gt;&lt;![CDATA[&quot;</span>,<span class="string">&quot;]]&gt;&lt;/nativeurl&gt;&quot;</span>)));</span><br><span class="line"></span><br><span class="line">        <span class="keyword">var</span> luckymoney_str = javaString.$new(<span class="string">&quot;luckymoney&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> luckymoneyUI_str = javaString.$new(<span class="string">&quot;.ui.LuckyMoneyNotHookReceiveUI&quot;</span>);</span><br><span class="line">        Java.use(<span class="string">&#x27;com.tencent.mm.br.d&#x27;</span>).b(content, luckymoney_str, luckymoneyUI_str,intent);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> clazz = Java.use(<span class="string">&#x27;com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI&#x27;</span>);</span><br><span class="line">        clazz.onSceneEnd.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> result = clazz.onSceneEnd.apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;click result:&quot;</span>,<span class="built_in">this</span>.wrX.value.performClick());</span><br><span class="line">            <span class="keyword">return</span> result;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">setImmediate(main);</span><br></pre></td></tr></table></figure>
<h2 id="参考文章">参考文章<a class="header-anchor" href="#参考文章"> ¶ </a></h2>
<p><a target="_blank" rel="noopener" href="https://www.toutiao.com/i6480401747104760333/">微信Log日志分析——初步探索 (toutiao.com)</a></p>
<p><a target="_blank" rel="noopener" href="https://www.52pojie.cn/thread-1097114-1-1.html">简单分析骰子流程 - 『移动安全区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn</a></p>
<p><a target="_blank" rel="noopener" href="https://www.52pojie.cn/thread-1097737-1-1.html">某聊天软件撤回流程的分析与防撤回实现 - 『移动安全区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn</a></p>
<p>[<a target="_blank" rel="noopener" href="https://bbs.pediy.com/thread-226260.htm">原创]Xposed第二课(微信篇) 聊天界面修改文字-Android安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com</a></p>
<p>[<a target="_blank" rel="noopener" href="https://bbs.pediy.com/thread-226674.htm">原创]Xposed第三课(微信篇) 防止好友消息撤回-Android安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com</a></p>
<p>[<a target="_blank" rel="noopener" href="https://bbs.pediy.com/thread-225878.htm">下载]微信6.6.1 Xposed模块 包含 主动发消息 防撤回 抢红包 骰子作弊 模拟位置 步数最高-Android安全-看雪论坛-安全社区|安全招聘|bbs.pediy.com</a></p>
<p>深表谢意</p>
<h2 id="最后">最后<a class="header-anchor" href="#最后"> ¶ </a></h2>
<p>应付完考试继续研究……</p>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="mailto:undefined">Forgo7ten</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://forgo7ten.github.io/AndroidReverse/2021/Analysis_of_WeChat/">https://forgo7ten.github.io/AndroidReverse/2021/Analysis_of_WeChat/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://Forgo7ten.github.io" target="_blank">Forgo7ten'blog</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/tags/Android%E9%80%86%E5%90%91/">Android逆向</a></div><div class="post_share"><div class="social-share" data-image="http://forgo7ten.gitee.io/store/imgs/18.jpg" data-sites="facebook,twitter,wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/social-share.js/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/social-share.js/dist/js/social-share.min.js" defer></script></div></div><div class="post-reward"><div class="reward-button"><i class="fas fa-qrcode"></i> 打赏</div><div class="reward-main"><ul class="reward-all"><li class="reward-item"><a href="/images/wechat.png" target="_blank"><img class="post-qr-code-img" src="/images/wechat.png" alt="wechat"/></a><div class="post-qr-code-desc">wechat</div></li><li class="reward-item"><a href="/images/alipay.jpg" target="_blank"><img class="post-qr-code-img" src="/images/alipay.jpg" alt="alipay"/></a><div class="post-qr-code-desc">alipay</div></li></ul></div></div><nav class="pagination-post" id="pagination"><div class="prev-post pull-left"><a href="/AndroidReverse/2021/Crack_com.xhey.xcamera/"><img class="prev-cover" src="http://forgo7ten.gitee.io/store/imgs/17.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of previous post"><div class="pagination-info"><div class="label">上一篇</div><div class="prev_info">今日水印相机自定义水印</div></div></a></div><div class="next-post pull-right"><a href="/Reverse/2021/Analysis_of_intent_redirection_derived_from_2021bytectf/"><img class="next-cover" src="http://forgo7ten.gitee.io/store/imgs/16.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of next post"><div class="pagination-info"><div class="label">下一篇</div><div class="next_info">由2021ByteCTF引出的intent重定向浅析</div></div></a></div></nav><div class="relatedPosts"><div class="headline"><i class="fas fa-thumbs-up fa-fw"></i><span>相关推荐</span></div><div class="relatedPosts-list"><div><a href="/AndroidReverse/2022/Android_dynamic_debugging_collection/" title="Android APK无源码动态调试合集"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/3.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-01-21</div><div class="title">Android APK无源码动态调试合集</div></div></a></div><div><a href="/AndroidReverse/2021/Initial_xposed_module_development/" title="Xposed 模块开发一 环境搭建"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/11.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-07-12</div><div class="title">Xposed 模块开发一 环境搭建</div></div></a></div><div><a href="/AndroidReverse/2022/Frida_all_in_one/" title="Frida all in one"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/14.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-04-23</div><div class="title">Frida all in one</div></div></a></div><div><a href="/AndroidReverse/2022/Learning_about_cryptographic_algorithms/" title="对加密算法的学习"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-02-07</div><div class="title">对加密算法的学习</div></div></a></div><div><a href="/AndroidReverse/2022/Android_devices_init/" title="Android刷机记录"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/13.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-05-03</div><div class="title">Android刷机记录</div></div></a></div><div><a href="/AndroidReverse/2021/Android_traffic_capture_configuration_collection/" title="Android抓包配置合集"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/1.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-07-24</div><div class="title">Android抓包配置合集</div></div></a></div></div></div><hr/><div id="post-comment"><div class="comment-head"><div class="comment-headline"><i class="fas fa-comments fa-fw"></i><span> 评论</span></div></div><div class="comment-wrap"><div><div id="gitalk-container"></div></div></div></div></div><div class="aside-content" id="aside-content"><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#vx%E9%80%86%E5%90%91%E5%88%86%E6%9E%90%E9%9A%8F%E7%AC%94"><span class="toc-number">1.</span> <span class="toc-text">vx逆向分析随笔</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#vx-Log%E6%97%A5%E5%BF%97"><span class="toc-number">1.1.</span> <span class="toc-text">vx Log日志</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#vx%E5%8F%91%E9%80%81%E6%B6%88%E6%81%AF"><span class="toc-number">1.2.</span> <span class="toc-text">vx发送消息</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#vx%E8%81%8A%E5%A4%A9%E7%AA%97%E5%8F%A3-%E4%BF%AE%E6%94%B9%E5%86%85%E5%AE%B9"><span class="toc-number">1.3.</span> <span class="toc-text">vx聊天窗口&#x2F;修改内容</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AE%9A%E4%BD%8D"><span class="toc-number">1.3.1.</span> <span class="toc-text">定位</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%88%86%E6%9E%90"><span class="toc-number">1.3.2.</span> <span class="toc-text">分析</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#MMChattingListView"><span class="toc-number">1.3.2.1.</span> <span class="toc-text">MMChattingListView</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#ChattingUIFragment"><span class="toc-number">1.3.2.2.</span> <span class="toc-text">ChattingUIFragment</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Adapter"><span class="toc-number">1.3.2.3.</span> <span class="toc-text">Adapter</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%AF%8F%E6%9D%A1%E6%B6%88%E6%81%AF-storage-bz"><span class="toc-number">1.3.2.4.</span> <span class="toc-text">每条消息 storage.bz</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E8%84%9A%E6%9C%AC%E5%AE%9E%E7%8E%B0"><span class="toc-number">1.3.3.</span> <span class="toc-text">脚本实现</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%B1%BB%E6%80%BB%E7%BB%93"><span class="toc-number">1.3.4.</span> <span class="toc-text">类总结</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#vx%E6%8A%95%E9%AA%B0%E5%AD%90"><span class="toc-number">1.4.</span> <span class="toc-text">vx投骰子</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%88%86%E6%9E%90-2"><span class="toc-number">1.4.1.</span> <span class="toc-text">分析</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E8%84%9A%E6%9C%AC%E5%AE%9E%E7%8E%B0-2"><span class="toc-number">1.4.2.</span> <span class="toc-text">脚本实现</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#vx%E9%98%B2%E6%92%A4%E5%9B%9E"><span class="toc-number">1.5.</span> <span class="toc-text">vx防撤回</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%88%86%E6%9E%90-3"><span class="toc-number">1.5.1.</span> <span class="toc-text">分析</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#4-c-processAddMsg"><span class="toc-number">1.5.1.1.</span> <span class="toc-text">4 c.processAddMsg()</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#5-b-b"><span class="toc-number">1.5.1.2.</span> <span class="toc-text">5 b.b()</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#6-ch-b"><span class="toc-number">1.5.1.3.</span> <span class="toc-text">6 ch.b()</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#%E8%BF%94%E5%9B%9E%E8%AF%A5%E5%87%BD%E6%95%B0%E7%9A%84%E5%88%86%E6%9E%90"><span class="toc-number">1.5.1.3.1.</span> <span class="toc-text">返回该函数的分析</span></a></li></ol></li><li class="toc-item toc-level-4"><a class="toc-link" href="#7-f-a"><span class="toc-number">1.5.1.4.</span> <span class="toc-text">7 f.a()</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%80%9D%E8%B7%AF"><span class="toc-number">1.5.2.</span> <span class="toc-text">思路</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E8%84%9A%E6%9C%AC%E5%AE%9E%E7%8E%B0-3"><span class="toc-number">1.5.3.</span> <span class="toc-text">脚本实现</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#vx%E8%87%AA%E5%8A%A8%E6%8A%A2%E7%BA%A2%E5%8C%85"><span class="toc-number">1.6.</span> <span class="toc-text">vx自动抢红包</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%88%86%E6%9E%90-4"><span class="toc-number">1.6.1.</span> <span class="toc-text">分析</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E7%BA%A2%E5%8C%85%E6%B6%88%E6%81%AF%E7%9B%91%E5%90%AC"><span class="toc-number">1.6.1.1.</span> <span class="toc-text">红包消息监听</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E7%BA%A2%E5%8C%85%E6%B5%81%E7%A8%8B%E5%88%86%E6%9E%90"><span class="toc-number">1.6.1.2.</span> <span class="toc-text">红包流程分析</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%80%9D%E8%B7%AF-2"><span class="toc-number">1.6.2.</span> <span class="toc-text">思路</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E8%84%9A%E6%9C%AC%E5%AE%9E%E7%8E%B0-4"><span class="toc-number">1.6.3.</span> <span class="toc-text">脚本实现</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%95%88%E6%9E%9C%E5%9B%BE"><span class="toc-number">1.6.3.1.</span> <span class="toc-text">效果图</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E4%BB%A3%E7%A0%81%E5%AE%9E%E7%8E%B0"><span class="toc-number">1.6.3.2.</span> <span class="toc-text">代码实现</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%8F%82%E8%80%83%E6%96%87%E7%AB%A0"><span class="toc-number">1.7.</span> <span class="toc-text">参考文章</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%9C%80%E5%90%8E"><span class="toc-number">1.8.</span> <span class="toc-text">最后</span></a></li></ol></li></ol></div></div></div></div></main><footer id="footer" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/18.jpg')"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2023 By Forgo7ten</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div><div class="footer_custom_text">Hi, welcome to my <a href="https://Forgo7ten.github.io/">blog</a>!</div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="translateLink" type="button" title="简繁转换">繁</button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><a id="to_comment" href="#post-comment" title="直达评论"><i class="fas fa-comments"></i></a><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div id="local-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">本地搜索</span><span id="loading-status"></span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="is-center" id="loading-database"><i class="fas fa-spinner fa-pulse"></i><span>  数据库加载中</span></div><div class="search-wrap"><div id="local-search-input"><div class="local-search-box"><input class="local-search-box--input" placeholder="搜索文章" type="text"/></div></div><hr/><div id="local-search-results"></div></div></div><div id="search-mask"></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="/js/tw_cn.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.js"></script><script src="https://cdn.jsdelivr.net/npm/instant.page/instantpage.min.js" type="module"></script><script src="https://cdn.jsdelivr.net/npm/vanilla-lazyload/dist/lazyload.iife.min.js"></script><script src="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.js"></script><script src="/js/search/local-search.js"></script><script>var preloader = {
  endLoading: () => {
    document.body.style.overflow = 'auto';
    document.getElementById('loading-box').classList.add("loaded")
  },
  initLoading: () => {
    document.body.style.overflow = '';
    document.getElementById('loading-box').classList.remove("loaded")

  }
}
window.addEventListener('load',preloader.endLoading())</script><div class="js-pjax"><script>function addGitalkSource () {
  const ele = document.createElement('link')
  ele.rel = 'stylesheet'
  ele.href= 'https://cdn.jsdelivr.net/npm/gitalk/dist/gitalk.min.css'
  document.getElementsByTagName('head')[0].appendChild(ele)
}

function loadGitalk () {
  function initGitalk () {
    var gitalk = new Gitalk(Object.assign({
      clientID: '9e01c692fcf5a9e47867',
      clientSecret: '6d5297eda0643a171a9e5510f5ea1c29ad851389',
      repo: 'Forgo7ten.github.io',
      owner: 'Forgo7ten',
      admin: ['Forgo7ten'],
      id: '8913b5f41f4ec694e6c6adc8ef99ba56',
      updateCountCallback: commentCount
    },{"language":"en","perPage":20,"distractionFreeMode":true,"pagerDirection":"last","createIssueManually":true}))

    gitalk.render('gitalk-container')
  }

  if (typeof Gitalk === 'function') initGitalk()
  else {
    addGitalkSource()
    getScript('https://cdn.jsdelivr.net/npm/gitalk@latest/dist/gitalk.min.js').then(initGitalk)
  }
}

function commentCount(n){
  let isCommentCount = document.querySelector('#post-meta .gitalk-comment-count')
  if (isCommentCount) {
    isCommentCount.innerHTML= n
  }
}

if ('Gitalk' === 'Gitalk' || !false) {
  if (false) btf.loadComment(document.getElementById('gitalk-container'), loadGitalk)
  else loadGitalk()
} else {
  function loadOtherComment () {
    loadGitalk()
  }
}</script></div><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/activate-power-mode.min.js"></script><script>POWERMODE.colorful = true;
POWERMODE.shake = true;
POWERMODE.mobile = false;
document.body.addEventListener('input', POWERMODE);
</script><script id="click-show-text" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/click-show-text.min.js" data-mobile="false" data-text="ヾ(≧▽≦*)o 点个收藏叭,(*^▽^*),w(ﾟДﾟ)w,ㄟ(≧◇≦)ㄏ,(/≧▽≦)/点个关注叭,Σ(っ °Д °;)っ,(●ˇ∀ˇ●),( •̀ ω •́ )✧,(*/ω＼*),ヽ(*。&gt;Д&lt;)o゜真的不收藏一下嘛,(～o￣3￣)～,ヽ（≧□≦）ノ" data-fontsize="15px" data-random="false" async="async"></script><script src="https://cdn.jsdelivr.net/npm/pjax/pjax.min.js"></script><script>let pjaxSelectors = ["title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]

var pjax = new Pjax({
  elements: 'a:not([target="_blank"])',
  selectors: pjaxSelectors,
  cacheBust: false,
  analytics: false,
  scrollRestoration: false
})

document.addEventListener('pjax:send', function () {

  // removeEventListener scroll 
  window.tocScrollFn && window.removeEventListener('scroll', window.tocScrollFn)
  window.scrollCollect && window.removeEventListener('scroll', scrollCollect)

  typeof preloader === 'object' && preloader.initLoading()
  document.getElementById('rightside').style.cssText = "opacity: ''; transform: ''"
  
  if (window.aplayers) {
    for (let i = 0; i < window.aplayers.length; i++) {
      if (!window.aplayers[i].options.fixed) {
        window.aplayers[i].destroy()
      }
    }
  }

  typeof typed === 'object' && typed.destroy()

  //reset readmode
  const $bodyClassList = document.body.classList
  $bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')

})

document.addEventListener('pjax:complete', function () {
  window.refreshFn()

  document.querySelectorAll('script[data-pjax]').forEach(item => {
    const newScript = document.createElement('script')
    const content = item.text || item.textContent || item.innerHTML || ""
    Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
    newScript.appendChild(document.createTextNode(content))
    item.parentNode.replaceChild(newScript, item)
  })

  GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()

  typeof chatBtnFn === 'function' && chatBtnFn()
  typeof panguInit === 'function' && panguInit()

  // google analytics
  typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});

  // baidu analytics
  typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);

  typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()

  // prismjs
  typeof Prism === 'object' && Prism.highlightAll()

  typeof preloader === 'object' && preloader.endLoading()
})

document.addEventListener('pjax:error', (e) => {
  if (e.request.status === 404) {
    pjax.loadUrl('/404.html')
  }
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"scale":1,"hHeadPos":0.5,"vHeadPos":0.618,"jsonPath":"/live2dw/assets/z16.model.json"},"display":{"superSample":2,"width":200,"height":400,"position":"right","hOffset":0,"vOffset":-20},"mobile":{"show":true,"scale":0.5},"react":{"opacityDefault":0.7,"opacityOnHover":0.2},"log":false});</script></body></html>